Security

The Security page is divided into tabs: Firewall (with ports, addresses, automatic defences, check and register), Access (fail2ban and mandatory two-step sign-in), the panel Certificate and the web Terminal.

Firewall

The firewall decides who can reach the server and from where. On top you see whether it is on or off, with the button to change it, and four numbers: reachable services and addresses in Allow, Block and Ignore.

Security check

The first number on top is the security score (out of 100). Click it, or open the Check tab, to see what to fix, most important first, with the Fix button that takes you where it is done: firewall on, fail2ban running, sign-in protection for SSH and the panel, permanent block, SSH with keys only and no password for root, databases not open to everyone, test mode, security updates, pending reboot, two-step sign-in mandatory for the administrators.

Test mode

With Test mode on (it is by default), after every change that could lock you out (turning the firewall on, changing the ports, adding a rule, blocking an address) a yellow box with a countdown appears: you have 5 minutes to press It works, confirm. If you don't confirm, because you can no longer reach the server, the panel puts the previous configuration back by itself.

Ports

Every service of the server (websites, SSH and SFTP, panel, mail, FTP, DNS, databases) has its card with the ports, whether it is listening and who can reach it:

Everyone: open to the whole Internet;
Only from…: only from the addresses you write (for example the database only from the application's server);
Closed: nobody from outside.

SSH and the panel can't be closed to everyone, and can be limited only to a list that includes your address: so you can't lock yourself out.

Addresses

Three lists for the whole server, as in WHM:

Allow: the address gets through on every port and is never blocked (for example your office). It counts inside a blocked network too;
Block: the address is refused on every port, before any other rule;
Ignore: fail2ban never blocks the address (for example a monitoring service); the ports stay as they are.

For every address (an IP or a network, IPv4 or IPv6) you can write a note and choose an expiry: 1 hour, 1 day, 1 week, 30 days or for ever. The panel shows who added it and when; at the expiry the address leaves the list by itself. The panel won't let you block your own address or those of the server.

Protection

The automatic defences, like LFD and cPHulk in WHM. They are changed together and saved with the bar at the bottom (with test mode on you have 5 minutes to confirm).

Sign-in attempts: for every service (SSH and SFTP, the panel, FTP, sending and reading mail, WordPress sign-in) you can turn the protection off or choose attempts, window and block duration; "general" uses the values of the Fail2ban box.
Permanent block: whoever is blocked several times (for example 3 times in a day) stays out for a week, a month or for ever, on every port.
Countries: block some countries or let in only the ones you choose, on every port or only on some services (for example SSH and the panel only from Italy). The panel tells you the country of your address and won't save a choice that would lock you out. The countries of the addresses come from DB-IP (CC BY 4.0), updated every week.
Flood and scans: limit the connections at once and the new connections a minute of a single address (websites by default), and block for a while whoever tries the closed ports.
Lists of malicious addresses: Spamhaus DROP (hijacked networks or used by criminals only) and DShield (the networks attacking the most these days), updated every day.
Outgoing mail from the mail server only: only the mail server and root can send email out (ports 25, 465 and 587): an infected site can't send spam by itself.

Private networks (10.x, 192.168.x…) and the addresses in Allow are never stopped by these defences.

Alerts: an email to the administrators (the addresses in Settings › Email) when an address is blocked for good, when someone signs in to SSH from an address never seen, and when many addresses are blocked in an hour (possible attack, at most one email every 6 hours). The attack also appears in the alerts on top of the panel.

With linked servers, in Addresses you can choose On the linked servers too: the same address is blocked, allowed or ignored on all of them, and when you remove it the panel asks whether to remove it there too. The panel tells you on which servers it failed (for example one with an old version).

Search an IP

Type an address and the panel tells you where it appears: in the lists (inside a network too), in the fail2ban jails, in the IP blocker of the sites and in the rules, with the last events. Unblock everywhere removes it from Block, from fail2ban and from the IP blocker of the sites that list it. If it is inside a blocked network, the panel tells you: the network stays, because it blocks other addresses too.

Register

Who was blocked and unblocked, by fail2ban or by the panel, and who changed what (addresses added, removed or expired, ports, changes confirmed or restored), today, in the last 7 or 30 days. Next to it, the addresses blocked most, with Block to stop them on every port.

Advanced rules

The single rules (allow, refuse or limit a port, also only from a given address) stay for special cases. The rules that keep SSH and the panel reachable can't be deleted.

If the site is behind a CDN, the server firewall sees the addresses of the CDN: for the visitors of that site use the IP blocker and the limit of requests in the Site rules.

fail2ban blocks for a while the addresses that repeatedly get the password wrong (for example on SSH). On the page you see the blocked addresses and you can:

unblock an address blocked by mistake;
block an address manually;
choose after how many attempts to block, for how long and in which time window to count the attempts;
set the IPs never blocked, for example your office one.

Activity log

On the Log page you find who did what, when and from which address: creations, changes, deletions, sign-ins to the panel and server switches.

Web terminal

This page also has the Web terminal box: who can open the root shell, session recording and closing after inactivity. See Web terminal.

Good habits

Use a long password, different from the ones you use elsewhere.
Enter your email on the Account page: if someone changes your password, you will know right away.
Configure backups and keep the repository password away from the server.